Named volume for workflows and added init for mountpoint for runtime

[TreeSloths]

Resolves #1940

Changed from bind volume to named volume which solved the host side directory permissions conflict,

This however exposed a second issue, which is another permission error as before. The workflows image does not create /app/data/ before switching to USER 1000:1000, it only sets workdir: /app/, copies app files, installs packages, then runs as 1000:1000. The image does not initialize the mountpoint for non-root runtime. This was solved by adding the following commands to the dofigen file:

... && mkdir -p /app/data && chown -R 1000:1000 /app/data

Initializing the directory before dropping privileges.

Test

After building the container locally and running the compose file, the compose file ran without a single hiccup for the first time compared to before.

 ✔ Image ghcr.io/openstatushq/openstatus-private-location:latest Pulled                                                                                       36.2s
 ✔ Image ghcr.io/tursodatabase/libsql-server:latest              Pulled                                                                                       68.3s
 ✔ Image ghcr.io/openstatushq/openstatus-checker:latest          Pulled                                                                                       37.0s
 ✔ Image ghcr.io/openstatushq/openstatus-dashboard:latest        Pulled                                                                                       239.1s
 ✔ Image ghcr.io/openstatushq/openstatus-server:latest           Pulled                                                                                       37.6s
 ✔ Image tinybirdco/tinybird-local:latest                        Pulled                                                                                       260.0s
 ✔ Image ghcr.io/openstatushq/openstatus-status-page:latest      Pulled                                                                                       238.8s
 ✔ Image openstatus/workflows:latest                             Built                                                                                        216.0s
 ✔ Network openstatus                                            Created                                                                                      0.4s
 ✔ Volume openstatus-workflows-data                              Created                                                                                      0.1s
 ✔ Volume openstatus-libsql-data                                 Created                                                                                      0.0s
 ✔ Container openstatus-libsql                                   Healthy                                                                                      20.6s
 ✔ Container openstatus-tinybird                                 Started                                                                                      7.4s
 **✔ Container openstatus-workflows                                Healthy                                                                                      16.7s**
 ✔ Container openstatus-server                                   Healthy                                                                                      20.9s
 ✔ Container openstatus-checker                                  Started                                                                                      22.5s
 ✔ Container openstatus-status-page                              Started                                                                                      22.9s
 ✔ Container openstatus-dashboard                                Started                                                                                      21.6s
 ✔ Container openstatus-private-location                         Started                                                                                      22.8s

The trade off however is that with /data/ no longer being a binded mount, it is not "as easy" to see where the directory actually exists on the host, however using docker inspect reveals the path:

$ sudo docker inspect openstatus-workflows --format '{{json .Mounts}}' | jq
[
  {
    "Type": "volume",
    "Name": "openstatus-workflows-data",
    "Source": "/var/lib/docker/volumes/openstatus-workflows-data/_data",
    "Destination": "/app/data",
    "Driver": "local",
    "Mode": "rw",
    "RW": true,
    "Propagation": ""
  }
]

So e.g. in my case: "/var/lib/docker/volumes/openstatus-workflows-data/_data"

[vercel]

@TreeSloths is attempting to deploy a commit to the OpenStatus Team on Vercel.

A member of the Team first needs to authorize it.

[TreeSloths]

@thibaultleouay @mxkaske Have you had the chance to review this PR?

[thibaultleouay]

@TreeSloths sorry weekend hit me hard, doing it now

[thibaultleouay]

@claude review this

[claude]

Claude Code is working…

I'll analyze this and get back to you.

View job run

[Copilot]

Pull request overview

This PR fixes a first-run permission error (issue #1940) where the openstatus-workflows container fails because its ./data:/app/data bind mount creates the directory as root, but the container runs as USER 1000:1000. The fix applies two complementary changes: switching from bind mounts to named Docker volumes, and pre-creating the /app/data directory with correct ownership in the Dockerfile.

Changes:

• Replaced the ./data:/app/data bind mount with a named volume workflows-data in both docker-compose.yaml and docker-compose.github-packages.yaml
• Added mkdir -p /app/data && chown -R 1000:1000 /app/data to the root run command in dofigen.yml, which propagates to the generated Dockerfile and dofigen.lock

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docker-compose.yaml	Added workflows-data named volume definition and updated workflows service to use it
docker-compose.github-packages.yaml	Same named volume change as above for the GitHub packages compose variant
apps/workflows/dofigen.yml	Added mkdir -p /app/data && chown -R 1000:1000 /app/data to the root run step
apps/workflows/Dockerfile	Auto-generated Dockerfile reflecting the dofigen.yml change
apps/workflows/dofigen.lock	Auto-generated lock file reflecting the dofigen.yml change and updated hash

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.